Turns out they get them from a lot of influential people... who would all be none too pleased if this was not an incident of malicious mal-ware, but rather a purposeful installation. I just can't see that being true though, with the stakes this high and the catch too easy...

http://www.steemreports.com/delegation-info/?account=dmania